AVideo YPTSocket XSS Leads Light Disclosure Day

A critical unauthenticated stored DOM cross-site scripting vulnerability in the AVideo YPTSocket plugin (CVE-2026-54458) allows any remote attacker to execute arbitrary JavaScript in the context of a victim's browser session by injecting malicious payloads through the page_title broadcast parameter. The flaw carries a high risk score of 0.52 and requires no authentication or user interaction beyond viewing the affected page. AVideo is a widely deployed open-source video platform, and the YPTSocket plugin handles real-time WebSocket communications, making this a high-value target for phishing, session hijacking, or credential theft campaigns. No patch or mitigation has been announced as of this writing, and no evidence of active exploitation has been reported yet.

Google disclosed a missing authorization vulnerability in a GraphQL private API operation within the App Engine section of Cloud Console (CVE-2026-8934), which allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects. The bug was uncovered by a security researcher who, as Cyber Security News reported, used AI-assisted techniques to chain multiple flaws and earned a $500,000 bug bounty. While Google has since remediated the issue, the disclosure highlights the growing role of AI in vulnerability discovery and the persistent risk of authorization gaps in cloud control planes.

IBM disclosed a cluster of vulnerabilities across WebSphere Application Server and Liberty, including an authentication bypass in JAX-WS applications (CVE-2026-10845), HTTP request smuggling (CVE-2026-8646), SSRF via the Ajax Proxy (CVE-2026-9006), and two denial-of-service flaws (CVE-2026-9320, CVE-2026-9071). These affect WebSphere 8.5 and 9.0 as well as Liberty 17.0.0.3 through 26.0.0.6. The authentication bypass is particularly concerning as it could allow a remote attacker to gain unauthorized access to SOAP-based web services without valid credentials. Organizations running IBM WebSphere in DMZ or internet-facing roles should prioritize patching to the latest fix pack.

The qSnapper snapshot management tool for Linux received fixes for a series of local privilege escalation and information disclosure vulnerabilities (CVE-2026-41045, CVE-2026-41046, CVE-2026-41047, CVE-2026-41048, CVE-2026-41049) in version 1.3.3. The most severe is a TOCTOU race condition in polkit authentication (CVE-2026-41045) that lets a local attacker bypass authentication and operate as root, while a path traversal flaw (CVE-2026-41046) allows using malicious snapper config files to escalate privileges. Additionally, incorrect authentication caching (CVE-2026-41049) and missing auth on snapshot diff functions (CVE-2026-41047) expose sensitive filesystem data to unprivileged users. These are particularly relevant for desktop Linux environments where qSnapper is used for Btrfs snapshot management.

Two authenticated stored cross-site scripting vulnerabilities were disclosed in Akaunting 3.1.21, an open-source accounting platform. CVE-2026-11943 allows an authenticated user to inject HTML/JavaScript via their profile name, which then executes in the document timeline shown on invoice and bill detail pages. CVE-2026-11942 similarly permits stored XSS through record names (such as Items) in the reusable delete confirmation flow. While both require authentication, they enable lateral movement and privilege escalation within the application by targeting administrators or other users who view the affected pages. No patch has been released yet.

The Angular Language Service VS Code extension was found to have two vulnerabilities: CVE-2026-50178, where the Markdown tooltip renderer is configured with isTrusted: true, enabling arbitrary code execution when a developer hovers over a crafted template expression, and CVE-2026-49241, which allows reading custom TypeScript SDK paths from workspace settings, potentially leaking sensitive configuration. Both affect versions prior to 21.2.4 and require the victim to open a malicious Angular project in VS Code. While the attack surface is limited to developer workstations, the impact is severe — full code execution in the context of the VS Code extension host. Users should update the extension to version 21.2.4 or later.